Commit 25ee48a5 authored by Jarkko Sakkinen's avatar Jarkko Sakkinen Committed by Jarkko Sakkinen

tpm: Address !chip->auth in tpm2_*_auth_session()

Unless tpm_chip_bootstrap() was called by the driver, !chip->auth can cause
a null derefence in tpm2_*_auth_session(). Thus, address !chip->auth in
tpm2_*_auth_session().

Cc: stable@vger.kernel.org # v6.9+
Reported-by: default avatarStefan Berger <stefanb@linux.ibm.com>
Closes: https://lore.kernel.org/linux-integrity/20240617193408.1234365-1-stefanb@linux.ibm.com/
Fixes: 699e3efd ("tpm: Add HMAC session start and end functions")
Tested-by: Michael Ellerman <mpe@ellerman.id.au> # ppc
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent 661e504d
...@@ -824,8 +824,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response); ...@@ -824,8 +824,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response);
*/ */
void tpm2_end_auth_session(struct tpm_chip *chip) void tpm2_end_auth_session(struct tpm_chip *chip)
{ {
tpm2_flush_context(chip, chip->auth->handle); struct tpm2_auth *auth = chip->auth;
memzero_explicit(chip->auth, sizeof(*chip->auth));
if (!auth)
return;
tpm2_flush_context(chip, auth->handle);
memzero_explicit(auth, sizeof(*auth));
} }
EXPORT_SYMBOL(tpm2_end_auth_session); EXPORT_SYMBOL(tpm2_end_auth_session);
...@@ -907,6 +912,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip) ...@@ -907,6 +912,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip)
int rc; int rc;
u32 null_key; u32 null_key;
if (!auth) {
dev_warn_once(&chip->dev, "auth session is not active\n");
return 0;
}
rc = tpm2_load_null(chip, &null_key); rc = tpm2_load_null(chip, &null_key);
if (rc) if (rc)
goto out; goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment